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Fig. 2B 
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THE TWO SECURITY ASSOCIATIONS, AT THE SECURITY SUBSYSTEMS, 
ESTABLISH A SHARED SECRET KEY TO BE USED FOR SYMMETRIC 
BLOCK ENCRYPTION (E.G., A DIFFIE-HELLMAN KEY EXCHANGE). 



USE ONE OF THE EGRESS SECURITY SUBSYSTEM AND INGRESS 
SECURITY SUBSYSTEM TO HOST THE SECURITY ASSOCIATION 



MAIN MODE AND QUICK MODE IKE EXCHANGES ARE PERFORMED TO 
ESTABLISH A SECURITY ASSOCIATION WITH A REMOTE PEER 



A "DELETE NOTIFICATION" MESSAGE ENCRYPTED 
WITH THE ISAKMP SA KEY IS CREATED AND SENT 
TO THE CCM ON THE CONTROL CARD 
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THE SERVICE CARD IDENTIFIER IS RECORDED AT THE 
CCM, AND PEER ADDRESS FOR THE NEWLY CREATED 
SECURITY ASSOCIATION IS RECORDED AT THE CCM 
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KEY, ENCRYPT SESSION DATA' I Fig. 7 A 



FORM AND SEND SECURITY MESSAGE INCLUDING AUTHENTICATION 
FOR AUTHENTICATING THE TRANSMISSION OF THE SESSION DATA 
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V. CHECK AUTHENTICATION AT RECEIVER SUBSYSTEM 
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DECRYPT THE SM BY THE RECIPIENT USING THE SHARED 
SECRET KEY OF STEP 700. THE DECRYPTED SESSION DATA 
IS THEN LOADED INTO THE SECURITY SUBSYSTEM TABLES. 
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MAIN MODE AND QUICK MODE IKE EXCHANGES ARE PERFORMED TO 
ESTABLISH A SECURITY ASSOCIATION WITH A REMOTE PEER 
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WITH THE ISAKMP SA KEY IS CREATED AND SENT 
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THE SERVICE CARD IDENTIFIER IS RECORDED AT THE 
CCM, AND PEER ADDRESS FOR THE NEWLY CREATED 
SECURITY ASSOCIATION IS RECORDED AT THE CCM 
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FORM AND SEND SECURITY MESSAGE INCLUDING AUTHENTICATION 
FOR AUTHENTICATING THE TRANSMISSION OF THE SESSION DATA 
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LOAD THE SESSION DATA INTO THE SECURITY SUBSYSTEM TABLES. 
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USE ONE OF THE EGRESS SECURITY SUBSYSTEM AND INGRESS 
SECURITY SUBSYSTEM TO HOST THE SECURITY ASSOCIATION 



MAIN MODE AND QUICK MODE IKE EXCHANGES ARE PERFORMED TO 
ESTABLISH A SECURITY ASSOCIATION WITH A REMOTE PEER 



A "DELETE NOTIFICATION" MESSAGE ENCRYPTED 
WITH THE ISAKMP SA KEY IS CREATED AND SENT 
TO THE CCM ON THE CONTROL CARD 
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